CVE-2026-22244: OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-08 · updated 2026-08-31
Weakness: CWE-1336

Description

OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

Affected products

open-metadata OpenMetadata: before 1.11.4 — fixed in 1.11.4

How to fix

Upgrade to a fixed version: open-metadata OpenMetadata 1.11.4. Check the vendor advisory for mitigations.

References

https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3
https://github.com/open-metadata/OpenMetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7

Get alerted when CVE-2026-22244 or the next vulnerability affects your stack